Impersonation

Admin users can impersonate others via RFC 8693 token exchange. Register the routes and navigate — the library handles the rest.

Setup

app.routes.ts

import { Routes } from '@angular/router';
import {
  createAuthCallbackRoute,
  createStartImpersonationRoute,
  createEndImpersonationRoute,
} from '@presencelearning/auth';

export const routes: Routes = [
  createAuthCallbackRoute(),
  createStartImpersonationRoute(),
  createEndImpersonationRoute(),
  // ...
];

Both route factories accept an overrides?: Partial<Route> argument. createStartImpersonationRoute() prepends authGuard automatically, and sanitizes the path query param against open redirects — protocol-relative and backslash-escaped values fall back to /.

Triggering impersonation

Either navigate to the routes:

// Trigger impersonation from any component
router.navigate(['/auth/impersonate', userId], { queryParams: { path: '/dashboard' } });

// End impersonation
router.navigate(['/auth/end-impersonation']);

Or drive it from the service directly:

await authService.startImpersonation(userId, '/dashboard');
authService.stopImpersonation();

Impersonation-aware state

AuthService exposes the impersonation-aware state:

authService.isImpersonating(); // Signal<boolean>
authService.currentUser(); // Signal<User | null> — impersonated user while active
authService.accessToken(); // Signal<string | null> — impersonation token while active
authService.originalUser(); // Signal<User | null> — the real admin user

Known limitations

Cross-app impersonation redirect: navigating between apps while preserving an active impersonation session is not supported. Each app performs its own RFC 8693 token exchange.